@manta-eu/auth 0.1.9 → 0.2.0

package/README.md

@@ -1,9 +1,12 @@
 # @manta-eu/auth
 
-Keycloak login for the SDK CLIs (`@manta-eu/codegen`, `@manta-eu/upload`): browser and device-code
-login, silent token renewal, and credential storage. It knows nothing about either CLI's own
-purpose — it only mints and renews tokens, and gives each CLI `login`/`logout`/`status` commands to
-register on its own `commander` program.
+Keycloak login for Manta: the SDK CLIs (`@manta-eu/codegen`, `@manta-eu/upload`) and a custom app's
+own server. It mints and renews tokens; it knows nothing about what a caller does with them. The root
+entry adds browser and device-code login with credential storage for the CLIs, and gives each CLI
+`login`/`logout`/`status` commands to register on its own `commander` program.
+
+`@manta-eu/auth/web` runs without Node — in a browser, a Worker, Deno or Bun — and holds the token
+cache, the web-app sign-in below, client credentials, and the issuer helpers.
 
 Documentation: [developers.manta.eu](https://developers.manta.eu)
 
@@ -59,6 +62,97 @@ import { mintWithClientCredentials } from "@manta-eu/auth";
 const accessToken = await mintWithClientCredentials({ baseUrl, realm, clientId, clientSecret, scope });
 ```
 
+## Sign in on your own server
+
+`webLoginRoutes` gives a custom app's server `/login`, `/callback` and `/logout`, and keeps the person's session in
+encrypted cookies, on standard `Request` and `Response`:
+
+```ts
+import { webLoginRoutes } from "@manta-eu/auth/web";
+
+const manta = webLoginRoutes({ client: { clientId, clientSecret }, appUrl, sessionSecret });
+
+const response = await manta.handle(request); // undefined for any other path
+const { accessToken, setCookies } = await manta.session(request); // renewed when about to expire
+```
+
+Or run the steps yourself:
+
+A custom app's server signs its people in with its client ID and secret, through the authorization
+code flow with PKCE, on a redirect URL registered for the app:
+
+```ts
+import { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl } from "@manta-eu/auth/web";
+
+const client = { baseUrl, realm, clientId, clientSecret };
+
+// 1. Send the person to `url`; keep `state` and `verifier` in their session.
+const { url, state, verifier } = await startWebLogin(client, { redirectUri, offlineAccess: true });
+
+// 2. On the redirect, check `state`, then trade the code for tokens.
+const tokens = await finishWebLogin(client, { code, redirectUri, verifier });
+
+// 3. Before the access token's five minutes run out, renew it.
+const renewed = await refreshWebLogin(client, tokens.refreshToken);
+
+// 4. Sign out of your app only, ending even an offline session...
+await endWebLogin(client, renewed.refreshToken);
+// ...or out of Manta too, returning to a redirect URL or the app's home URL.
+const logoutUrl = webLogoutUrl(client, { idToken: renewed.idToken, postLogoutRedirectUri: homeUrl });
+```
+
+Store the refresh token `refreshWebLogin` returns in place of the old one: Manta's realms rotate it,
+and an old one is accepted at most once more. `undefined` means the person signs in again.
+`offlineAccess: true` keeps the session alive while it is used, until 30 idle days or a year.
+
+## Machine access
+
+A custom app with machine access mints its own token, with no person involved:
+
+```ts
+import { cachedToken, mintWithClientCredentials } from "@manta-eu/auth/web";
+
+const getAccessToken = cachedToken(() => mintWithClientCredentials({ baseUrl, realm, clientId, clientSecret }));
+```
+
+Keep the secret on a server; never ship it to a browser.
+
+## Tokens for your app's own users
+
+A custom app with machine access gets a token for one of its own users, by the app's id for them, or
+for a visitor it has not identified, by its session id for them. Manta keeps their chats, and no
+memories:
+
+```ts
+import { cachedToken, customAppUserAccessToken } from "@manta-eu/auth/web";
+
+// One cached getter per person, so each reuses their token until it nears expiry. Evict idle entries in a real app.
+const tokens = new Map<string, () => Promise<string>>();
+const tokenFor = (userId: string) => {
+  let get = tokens.get(userId);
+  if (get === undefined) {
+    get = cachedToken(() =>
+      customAppUserAccessToken({ clientId, clientSecret, userId, name, email, teams: ["/Sales/EU"] }),
+    );
+    tokens.set(userId, get);
+  }
+  return get;
+};
+```
+
+A visitor works the same way, keyed by your session id and with `anonymousId: sessionId` in place of `userId`.
+
+It sends the app's secret, so it runs on the app's server only; the token it returns may go to the
+browser. `datastores` narrows the token to some of the datastores the app reaches. `teams` places
+the person in those teams of the app's organization: an empty list places them in none, and leaving
+it out places them in every team the app reaches. A refusal throws `RefusedRequestError`, whose
+`status` tells `isTransientStatus` whether a retry can help (429, 503) or not (401, 403).
+
+## Issuer and discovery
+
+`issuerUrl({ baseUrl, realm })` names the realm's issuer, and `discoveryUrl({ baseUrl, realm })` its
+OpenID Connect discovery document, which most OIDC libraries configure themselves from.
+
 ## Renewing on refusal
 
 `withRenewal(token, call)` calls `call` with a fresh access token, and on a 401 specifically calls

package/dist/auth-commands.js

@@ -139,3 +139,4 @@ export function registerAuthCommands(program, { label, store = defaultCredential
             process.exitCode = 1;
     }));
 }
+//# sourceMappingURL=auth-commands.js.map

package/dist/auth-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-commands.js","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAwB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,cAAc,EAEd,mBAAmB,EAEnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAkB,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAA6B,MAAM,YAAY,CAAC;AAI5E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,GAAG,KAAK,MAAM,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,gDAAgD,UAAU,4BAA4B,CAAC;AAInH,MAAM,UAAU,gBAAgB,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAiB;IACtF,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,KAAK,CAAC,MAAoB;IACjC,OAAO,GAAG,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,KAAK,GACiD;IAEpE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IAEvC,IAAI,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;QAEtF,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,UAAU,KAAK,CAAC,eAAe,uBAAuB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IAAI,YAAY;YAAE,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEvD,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,SAAS;QACT,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,4DAA4D,GAAG,EAAE,CAAC,CAAC;YACzF,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAoB,EAAE,MAAoB,EAAE,KAAc;IACnG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,kBAAkB,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,kEAAkE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAoB;IAC7D,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,OAAO,KAAK,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,OAAO,EAAE;QAC3F,MAAM,CAAC,KAAK,KAAK,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,KAAK,EAAE;QAC3F,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,QAAQ,EAAE;KACvF,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,OAAO,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAK,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EACvD,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1C,SAAS,GAAG,KAAK,GAOlB;IAED,OAAO,sBAAsB,CAAC;QAC5B,MAAM;QACN,KAAK;QACL,SAAS;QACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;QACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC,WAAW;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YACnF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAEjE,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,GAAG,OAAO,WAAW,KAAK,iCAAiC,CAAC;AACrE,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,YAAoB,EACpB,YAAuB,KAAK;IAE5B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEnH,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAK,EACL,SAAS,GAAG,KAAK,GACyE;IAE5F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAoB,EACpB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,EAAoE;IAErG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,sBAAsB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,CAAC,KAAK,CACX,OAAO;QACL,CAAC,CAAC,GAAG,KAAK,mBAAmB,KAAK,CAAC,MAAM,CAAC,EAAE;QAC5C,CAAC,CAAC,GAAG,KAAK,kCAAkC,KAAK,CAAC,MAAM,CAAC,gDAAgD,CAC5G,CAAC;AACJ,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,EAAE,KAAK,EAA8B;IAErC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAEnF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,IAAY,EAAE,WAAmB;IACxE,OAAO,OAAO;SACX,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,WAAW,CAAC;SACxB,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,WAAW,CAAC;SAClF,MAAM,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,aAAa,CAAC;SACrF,MAAM,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAA2B;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,EACE,KAAK,EACL,KAAK,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EACvD,SAAS,GAAG,KAAK,GACiD;IAEpE,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,CAAC;SAChG,MAAM,CAAC,mBAAmB,EAAE,0EAA0E,CAAC;SACvG,MAAM,CAAC,CAAC,OAAqC,EAAE,EAAE,CAChD,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC3B,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CACpG,CACF,CAAC;IAEJ,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAC,MAAM,CAC1F,CAAC,OAAsB,EAAE,EAAE,CACzB,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAChG,CAAC;IAEF,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAsB,EAAE,EAAE,CACnG,gBAAgB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/browser-login.js

@@ -127,3 +127,4 @@ export async function browserLogin(client, { openUrl, fetchImpl = fetch, scope =
         callback.close();
     }
 }
+//# sourceMappingURL=browser-login.js.map

package/dist/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAuD,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAElD,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAClE,OAAO,GAAG,OAAO,WAAW,KAAK,+BAA+B,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAA4E;IAElH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,WAAW;QACzB,KAAK;QACL,KAAK;QACL,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,OAAe;IAC1C,OAAO,CACL,qEAAqE,KAAK,iBAAiB;QAC3F,4GAA4G;QAC5G,kCAAkC,KAAK,WAAW,OAAO,oBAAoB,CAC9E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,WAA0B;IAChE,OAAO,KAAK,KAAK,eAAe;QAC9B,CAAC,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC;QACpD,CAAC,CAAC,IAAI,KAAK,CAAC,kCAAkC,WAAW,IAAI,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAID,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAAoB,gBAAgB;IACzF,IAAI,MAAuF,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtF,wGAAwG;IACxG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAE5D,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAChE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvG,sGAAsG;QACtG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,+EAA+E,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,0CAA0C,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,EAAE,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;QACzF,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,0EAA0E,EAAE;YAC1F,KAAK;SACN,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,EACnF,SAAS,CACV,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,GAAG,YAAY,EAAE;QACtD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAA2D,EACxF,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,QAAQ,EACR,QAAQ,CACT,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,kCAAkC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CACvG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAoB,EACpB,GAAW,EACX,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mDAAmD,QAAQ,CAAC,MAAM,IAAI;YACpE,oBAAoB,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,mBAAmB,MAAM,CAAC,QAAQ,GAAG,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,EACE,OAAO,EACP,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,UAAU,EAClB,SAAS,GAAG,gBAAgB,EAC5B,IAAI,GAAG,cAAc,EAAE,EACvB,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAQ9C;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE;YACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC;QAEb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;QAEjC,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/browser.js

@@ -25,3 +25,4 @@ export function openInBrowser(url, platform = process.platform) {
         return;
     }
 }
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,UAAU,eAAe,CAC7B,MAA0C,OAAO,CAAC,GAAG,EACrD,WAAmB,OAAO,CAAC,QAAQ;IAEnC,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAE7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAAmB,OAAO,CAAC,QAAQ;IAC7E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpF,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,WAAmB,OAAO,CAAC,QAAQ;IAC5E,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;AACH,CAAC"}

package/dist/credential-store.js

@@ -165,3 +165,4 @@ export function defaultCredentialStore({ platform = process.platform, warn = con
         warn: (reason) => warn(`${reason} Stored it in ${path} instead.`),
     });
 }
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAW1C,0GAA0G;AAC1G,MAAM,UAAU,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAgB;IACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAA0C,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAgC,CAAC;IAE7E,OAAO,CACL,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;QACxD,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CACvD,CAAC;AACJ,CAAC;AAID,SAAS,aAAa,CAAC,KAAc;IACnC,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,yDAAyD,CAAC,CAAC;IAC/F,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAI,MAAsC,EAAE,MAAM,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,UAAU,CAAC;IAEpE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAkC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAClG;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAqB;IACrE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAEhE,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,OAAe,mBAAmB,EAAE;IACtE,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAE7C,MAAM,oBAAoB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO;YAEjC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YAChD,MAAM,oBAAoB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,WAAW,GAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,SAAS,eAAe,CAAC,MAAoB;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnC,uFAAuF;IACvF,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,mBAAmB,CAAC,CAAC;IAErG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1F,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,MAAmB,WAAW;IACpE,KAAK,UAAU,IAAI,CAAC,MAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAE/G,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,8BAA8B,eAAe,QAAQ,eAAe,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC;YAE/G,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAE3B,oGAAoG;YACpG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,GAAG,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,wBAAwB,CACtC,QAAyB,EACzB,IAAqB,EACrB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,KAAgE,EAAE;IAE5G,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aAC7C,CAAC,CAAC;YAEH,uGAAuG;YACvG,OAAO,CAAC,YAAY,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QAC7G,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAE/C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEtE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClC,IAAI,WAAW;oBAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAC3B,IAAI,GAAG,OAAO,CAAC,KAAK,MACuC,EAAE;IAC7D,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvC,OAAO,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE;QAC/D,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,IAAI,WAAW,CAAC;KAClE,CAAC,CAAC;AACL,CAAC"}

package/dist/custom-app-user-token.d.ts

@@ -0,0 +1,33 @@
+import { type CustomAppUserProfile } from "@manta-eu/lib/custom-app";
+import { type FetchLike } from "./http.js";
+export type CustomAppUserGrantBase = {
+    /** The custom app's client ID and secret, held only by the app's server. */
+    clientId: string;
+    clientSecret: string;
+    /** Narrows the token to these datastores; leave out to reach every datastore the app reaches. */
+    datastores?: string[];
+    /**
+     * Places the person in these teams of the app's organization, by path like /Sales/EU, as a member of them. An empty
+     * list places them in no team; leaving it out places them in every team the app reaches.
+     */
+    teams?: string[];
+    /** Manta's address, https://app.hiremanta.com unless you name another deployment. */
+    apiUrl?: string;
+};
+/** A person your app knows: Manta keeps their chats under your id for them, and no memories. */
+export type IdentifiedCustomAppUser = CustomAppUserGrantBase & CustomAppUserProfile & {
+    userId: string;
+    anonymousId?: never;
+};
+/** A visitor your app has not identified, by your session id for them: they chat, and Manta keeps no memories. */
+export type AnonymousCustomAppVisitor = CustomAppUserGrantBase & {
+    anonymousId: string;
+    userId?: never;
+};
+export type CustomAppUserAccessTokenOptions = IdentifiedCustomAppUser | AnonymousCustomAppVisitor;
+/**
+ * Gets a Manta access token for one of the app's own users, or for an anonymous visitor. It sends the app's client
+ * secret, so call it on the app's server only; the token it returns may go to the browser.
+ */
+export declare function customAppUserAccessToken(options: CustomAppUserAccessTokenOptions, fetchImpl?: FetchLike): Promise<string>;
+//# sourceMappingURL=custom-app-user-token.d.ts.map

package/dist/custom-app-user-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app-user-token.d.ts","sourceRoot":"","sources":["../src/custom-app-user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,oBAAoB,EAE1B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,KAAK,SAAS,EAAyC,MAAM,WAAW,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG;IACnC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,gGAAgG;AAChG,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,GAC1D,oBAAoB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEjE,kHAAkH;AAClH,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEzG,MAAM,MAAM,+BAA+B,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;AAoBlG;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,EACxC,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoCjB"}

package/dist/custom-app-user-token.js

@@ -0,0 +1,56 @@
+import { customAppClientIdProblem, customAppUserDatastoresProblem, customAppUserIdProblem, customAppUserProfileProblem, customAppUserTeamsProblem, customAppUserTokenPath, } from "@manta-eu/lib/custom-app";
+import { isPresent } from "@manta-eu/lib/present";
+import { defaultDeployment } from "./default-deployment.js";
+import { postTo, readJson, RefusedRequestError } from "./http.js";
+function requestFor(options) {
+    const { clientId, clientSecret, datastores, teams } = options;
+    const narrowed = { ...(datastores === undefined ? {} : { datastores }), ...(teams === undefined ? {} : { teams }) };
+    if (options.userId === undefined) {
+        return { client_id: clientId, client_secret: clientSecret, anonymous_id: options.anonymousId, ...narrowed };
+    }
+    const { userId, name, email, fields } = options;
+    return {
+        client_id: clientId,
+        client_secret: clientSecret,
+        user_id: userId,
+        ...(name === undefined ? {} : { name }),
+        ...(email === undefined ? {} : { email }),
+        ...(fields === undefined ? {} : { fields }),
+        ...narrowed,
+    };
+}
+/**
+ * Gets a Manta access token for one of the app's own users, or for an anonymous visitor. It sends the app's client
+ * secret, so call it on the app's server only; the token it returns may go to the browser.
+ */
+export async function customAppUserAccessToken(options, fetchImpl = fetch) {
+    if (typeof globalThis.document !== "undefined") {
+        throw new Error("customAppUserAccessToken runs on your server only: it sends the app's client secret");
+    }
+    const clientIdProblem = customAppClientIdProblem(options.clientId);
+    if (clientIdProblem !== undefined)
+        throw new Error(clientIdProblem);
+    if (!isPresent(options.clientSecret))
+        throw new Error("The app's client secret is required");
+    const problem = customAppUserIdProblem(options.userId ?? options.anonymousId) ??
+        customAppUserDatastoresProblem(options.datastores) ??
+        customAppUserTeamsProblem(options.teams) ??
+        (options.userId === undefined ? undefined : customAppUserProfileProblem(options));
+    if (problem !== undefined)
+        throw new Error(problem);
+    const endpoint = new URL(customAppUserTokenPath, options.apiUrl ?? defaultDeployment.apiUrl).toString();
+    const response = await postTo(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(requestFor(options)),
+    }, fetchImpl);
+    if (!response.ok) {
+        const refusal = await readJson(response, endpoint).catch(() => ({}));
+        throw new RefusedRequestError(`Manta refused the custom app user token (${response.status}). ${refusal.error_description ?? ""}`.trim(), response.status);
+    }
+    const body = await readJson(response, endpoint);
+    if (typeof body.access_token !== "string")
+        throw new Error("Manta answered without an access token");
+    return body.access_token;
+}
+//# sourceMappingURL=custom-app-user-token.js.map

package/dist/custom-app-user-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app-user-token.js","sourceRoot":"","sources":["../src/custom-app-user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAkB,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA0BlF,SAAS,UAAU,CAAC,OAAwC;IAC1D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACpH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwC,EACxC,YAAuB,KAAK;IAE5B,IAAI,OAAQ,UAAqC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,OAAO,GACX,sBAAsB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC;QAC7D,8BAA8B,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAC3B,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KAC1C,EACD,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAiC,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CACtF,GAAmC,EAAE,CAAC,CAAC,EAAE,CAAC,CAC3C,CAAC;QACF,MAAM,IAAI,mBAAmB,CAC3B,4CAA4C,QAAQ,CAAC,MAAM,MAAM,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EACzG,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA4B,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC"}

package/dist/default-deployment.d.ts

@@ -3,4 +3,12 @@ export declare const defaultDeployment: {
     readonly keycloakUrl: "https://auth.hiremanta.com";
     readonly keycloakRealm: "hiremanta-com";
 };
+export type Realm = {
+    baseUrl?: string;
+    realm?: string;
+};
+export declare function realmOrDefault(target?: Realm): {
+    baseUrl: string;
+    realm: string;
+};
 //# sourceMappingURL=default-deployment.d.ts.map

package/dist/default-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-deployment.d.ts","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC"}
+{"version":3,"file":"default-deployment.d.ts","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,MAAM,KAAK,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAgB,cAAc,CAAC,MAAM,GAAE,KAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAKrF"}

package/dist/default-deployment.js

@@ -4,3 +4,10 @@ export const defaultDeployment = {
     keycloakUrl: "https://auth.hiremanta.com",
     keycloakRealm: "hiremanta-com",
 };
+export function realmOrDefault(target = {}) {
+    return {
+        baseUrl: (target.baseUrl ?? defaultDeployment.keycloakUrl).replace(/\/+$/, ""),
+        realm: target.realm ?? defaultDeployment.keycloakRealm,
+    };
+}
+//# sourceMappingURL=default-deployment.js.map

package/dist/default-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-deployment.js","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,2BAA2B;IACnC,WAAW,EAAE,4BAA4B;IACzC,aAAa,EAAE,eAAe;CACtB,CAAC;AAIX,MAAM,UAAU,cAAc,CAAC,SAAgB,EAAE;IAC/C,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9E,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,aAAa;KACvD,CAAC;AACJ,CAAC"}

package/dist/device-login.js

@@ -103,3 +103,4 @@ export async function refreshAccessToken(client, refreshToken, fetchImpl = fetch
         return undefined;
     return { accessToken: body.access_token, refreshToken: body.refresh_token ?? refreshToken };
 }
+//# sourceMappingURL=device-login.js.map

package/dist/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAkB,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAqB3C,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE,wEAAwE;AACxE,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,MAAM,QAAQ,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5E,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,GAAG,OAAO,WAAW,KAAK,sCAAsC,CAAC;AAC1E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAWD,SAAS,eAAe,CAAC,IAAyB,EAAE,QAAgB,EAAE,YAAoB;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAEhF,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB;QACpE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB;QAC1E,YAAY;KACb,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,YAAuB,KAAK,EAC5B,OAAiB,cAAc,EAAE,EACjC,KAAc;IAEd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,yCAAyC,QAAQ,CAAC,MAAM,IAAI;YACrE,yBAAyB,MAAM,CAAC,QAAQ,8CAA8C,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAsB,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB,EAAE,MAAc;IACnE,IAAI,KAAK,KAAK,uBAAuB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAElG,OAAO,IAAI,KAAK,CAAC,iCAAiC,KAAK,IAAI,MAAM,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB,EAAE,UAAkB,EAAE,YAAoB;IACxF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;AACL,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoB,EACpB,EACE,UAAU,EACV,YAAY,EACZ,UAAU,GAAG,iBAAiB,EAC9B,WAAW,GAAG,kBAAkB,GACiE,EACnG,EACE,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,QAAQ,EAChB,KAAK,GAAG,IAAI,CAAC,GAAG,MACkD,EAAE;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC;IACvC,IAAI,IAAI,GAAG,UAAU,CAAC;IAEtB,SAAS,CAAC;QACR,4EAA4E;QAC5E,IAAI,KAAK,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAE7F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEnH,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjH,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAE3B,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;YAAE,IAAI,IAAI,cAAc,CAAC;QAEvD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,YAAoB,EACpB,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5D,uGAAuG;IACvG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoD,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnG,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;AAC9F,CAAC"}

package/dist/http.js

@@ -38,3 +38,4 @@ export function describeError(error) {
         return String(error);
     return error.cause instanceof Error ? `${error.message}\n  caused by: ${error.cause.message}` : error.message;
 }
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,MAA8B;IACxD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;IAGzB,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,QAAkB,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oBAAoB,QAAQ,CAAC,MAAM,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAiB,EAAE,YAAuB,KAAK;IAC5F,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,kBAAkB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAChH,CAAC"}

package/dist/index.d.ts

@@ -6,4 +6,8 @@ export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, type DeviceL
 export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError, type FetchLike } from "./http.js";
 export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
 export { cachedToken, mintWithClientCredentials, withRenewal, type ClientCredentials, type RenewableTokenSource, type TokenSource, } from "./token.js";
+export { discoveryUrl, issuerUrl, type OidcClient, type Realm } from "./oidc.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, type StartWebLoginOptions, type WebLoginStart, type WebLogoutOptions, type WebTokens, } from "./web-login.js";
+export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+export { customAppUserAccessToken, type AnonymousCustomAppVisitor, type CustomAppUserAccessTokenOptions, type CustomAppUserGrantBase, type IdentifiedCustomAppUser, } from "./custom-app-user-token.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -6,3 +6,8 @@ export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, } from "./de
 export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError } from "./http.js";
 export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
 export { cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js";
+export { discoveryUrl, issuerUrl } from "./oidc.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
+export { webLoginRoutes } from "./web-routes.js";
+export { customAppUserAccessToken, } from "./custom-app-user-token.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,GAKzB,MAAM,4BAA4B,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,15 @@
+import * as oidc from "openid-client";
+import { type Realm } from "./default-deployment.js";
+import type { PublicClient } from "./device-login.js";
+import type { FetchLike } from "./http.js";
+export type { Realm };
+/** A client with a secret is an app's own server; without one it is a public client, like the CLIs. */
+export type OidcClient = Omit<PublicClient, "baseUrl" | "realm"> & Realm & {
+    clientSecret?: string;
+};
+/** The realm's issuer, the `iss` of every token it signs. */
+export declare function issuerUrl(target?: Realm): string;
+/** The OpenID Connect discovery document most libraries configure themselves from. */
+export declare function discoveryUrl(target?: Realm): string;
+export declare function oidcConfiguration(client: OidcClient, fetchImpl?: FetchLike): oidc.Configuration;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErG,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAGhD;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAEnD;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,aAAa,CAiB/F"}

package/dist/oidc.js

@@ -0,0 +1,27 @@
+import * as oidc from "openid-client";
+import { realmOrDefault } from "./default-deployment.js";
+/** The realm's issuer, the `iss` of every token it signs. */
+export function issuerUrl(target) {
+    const { baseUrl, realm } = realmOrDefault(target);
+    return `${baseUrl}/realms/${realm}`;
+}
+/** The OpenID Connect discovery document most libraries configure themselves from. */
+export function discoveryUrl(target) {
+    return `${issuerUrl(target)}/.well-known/openid-configuration`;
+}
+// Keycloak's endpoints are fixed under the issuer, so no discovery request precedes each call.
+export function oidcConfiguration(client, fetchImpl) {
+    const issuer = issuerUrl(client);
+    const endpoint = (name) => `${issuer}/protocol/openid-connect/${name}`;
+    const config = new oidc.Configuration({
+        issuer,
+        authorization_endpoint: endpoint("auth"),
+        token_endpoint: endpoint("token"),
+        end_session_endpoint: endpoint("logout"),
+        revocation_endpoint: endpoint("revoke"),
+    }, client.clientId, undefined, client.clientSecret ? oidc.ClientSecretPost(client.clientSecret) : oidc.None());
+    if (fetchImpl)
+        config[oidc.customFetch] = (url, options) => fetchImpl(url, options);
+    return config;
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AASrE,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,GAAG,OAAO,WAAW,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,mCAAmC,CAAC;AACjE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,SAAqB;IACzE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,4BAA4B,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CACnC;QACE,MAAM;QACN,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC;QACxC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC;QACjC,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACxC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC;KACxC,EACD,MAAM,CAAC,QAAQ,EACf,SAAS,EACT,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAC/E,CAAC;IACF,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stored-login.js

@@ -33,3 +33,4 @@ export function storedLoginTokenSource({ client, store, login, warn = console.er
     }
     return cachedToken(renewOrLogIn, clock);
 }
+//# sourceMappingURL=stored-login.js.map

package/dist/stored-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-login.js","sourceRoot":"","sources":["../src/stored-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAkB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAA6B,MAAM,YAAY,CAAC;AAEzF,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAsB,EAAE,MAAoB,EAAE,MAAoB;IAChG,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,GAAG,OAAO,CAAC,KAAK,EACpB,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,GAQjB;IACC,2GAA2G;IAC3G,KAAK,UAAU,IAAI,CAAC,MAAoB;QACtC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAEjF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,OAAO,CAAC,WAAW,CAAC;YAC7B,CAAC;YAED,MAAM,KAAK;iBACR,MAAM,CAAC,MAAM,CAAC;iBACd,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,uCAAuC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC"}

package/dist/token.d.ts

@@ -1,14 +1,13 @@
+import { type Realm } from "./default-deployment.js";
 import { type FetchLike } from "./http.js";
-export type ClientCredentials = {
-    baseUrl: string;
-    realm: string;
+export type ClientCredentials = Realm & {
     clientId: string;
     clientSecret: string;
     scope?: string;
 };
 export type TokenSource = () => Promise<string>;
 export type RenewableTokenSource = TokenSource & {
-    renew: () => void;
+    renew: (rejected?: string) => void;
 };
 export declare function withRenewal<T>(token: TokenSource, call: (accessToken: string) => Promise<T>): Promise<T>;
 export declare const tokenExpiryBufferMs = 60000;

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAOvE,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAiBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CAoBnG"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAOxF,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AA0BD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CA6BnG"}

package/dist/token.js

@@ -1,16 +1,19 @@
+import { realmOrDefault } from "./default-deployment.js";
 import { formRequest, postTo, RefusedRequestError } from "./http.js";
 function isRenewable(token) {
     return typeof token.renew === "function";
 }
 // A token revoked or expired early answers 401 once; renewing and retrying once is what Claude Code does for MCP.
 export async function withRenewal(token, call) {
+    let accessToken;
     try {
-        return await call(await token());
+        accessToken = await token();
+        return await call(accessToken);
     }
     catch (error) {
         if (!(error instanceof RefusedRequestError && error.status === 401) || !isRenewable(token))
             throw error;
-        token.renew();
+        token.renew(accessToken);
         return call(await token());
     }
 }
@@ -21,13 +24,21 @@ export const unparsableTokenTtlMs = 30_000;
 export function tokenEndpoint(baseUrl, realm) {
     return `${baseUrl}/realms/${realm}/protocol/openid-connect/token`;
 }
+// atob and TextDecoder, not Buffer, so the token helpers also run in a browser.
+function decodeBase64Url(value) {
+    const base64 = value
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(Math.ceil(value.length / 4) * 4, "=");
+    return new TextDecoder().decode(Uint8Array.from(atob(base64), (char) => char.charCodeAt(0)));
+}
 // Reads the claims without checking the signature: callers only use them to schedule and to label.
 function unverifiedClaims(accessToken) {
     const payload = accessToken.split(".")[1];
     if (!payload)
         return {};
     try {
-        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        const claims = JSON.parse(decodeBase64Url(payload));
         return typeof claims === "object" && claims !== null ? claims : {};
     }
     catch {
@@ -62,29 +73,43 @@ function readAccessToken(body, realm) {
     return accessToken;
 }
 export async function mintWithClientCredentials(credentials, fetchImpl = fetch) {
-    const { baseUrl, realm } = credentials;
+    const { baseUrl, realm } = realmOrDefault(credentials);
     const endpoint = tokenEndpoint(baseUrl, realm);
     const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
     if (!response.ok) {
+        const { error } = (await response.json().catch(() => ({})));
         throw new Error(`Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
-            `Check the client id and the secret against ${endpoint}.`);
+            (error === "unauthorized_client"
+                ? "This client may not mint tokens on its own: for a custom app, turn on Machine access."
+                : `Check the client id and the secret against ${endpoint}.`));
     }
     return readAccessToken(await response.json(), realm);
 }
 export function cachedToken(mint, clock = Date.now) {
     let held;
-    const source = async () => {
-        const now = clock();
-        if (held && isFresh(held.expiresAt, now))
-            return held.token;
+    // Shared, so callers racing an expired token start one mint: parallel refreshes would spend one refresh token.
+    let minting;
+    const mintOnce = async () => {
         const token = await mint();
         // A device login blocks until the browser answers, so `now` is already stale here.
         held = { token, expiresAt: accessTokenExpiresAt(token, clock()) };
         return token;
     };
+    const source = async () => {
+        if (held && isFresh(held.expiresAt, clock()))
+            return held.token;
+        const current = (minting ??= mintOnce().finally(() => {
+            if (minting === current)
+                minting = undefined;
+        }));
+        return current;
+    };
     return Object.assign(source, {
-        renew: () => {
-            held = undefined;
+        // Keeps an in-flight mint, so racing 401s join it, and a newer token than the one refused.
+        renew: (rejected) => {
+            if (rejected === undefined || held?.token === rejected)
+                held = undefined;
         },
     });
 }
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAarF,SAAS,WAAW,CAAC,KAAkB;IACrC,OAAO,OAAQ,KAAuC,CAAC,KAAK,KAAK,UAAU,CAAC;AAC9E,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAkB,EAAE,IAAyC;IAChG,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAExG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,OAAO,GAAG,OAAO,WAAW,KAAK,gCAAgC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,GAAW;IACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IAE9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,GAAG,oBAAoB,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC;IAEvD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,OAAO,SAAS,GAAG,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAqB;IACpF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,KAAa;IACnD,MAAM,WAAW,GAAI,IAAmC,CAAC,YAAY,CAAC;IAEtE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA8B,EAC9B,YAAuB,KAAK;IAE5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,gBAAgB,QAAQ,CAAC,MAAM,IAAI;YAC3F,CAAC,KAAK,KAAK,qBAAqB;gBAC9B,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,QAAsB,IAAI,CAAC,GAAG;IAC3E,IAAI,IAAsD,CAAC;IAC3D,+GAA+G;IAC/G,IAAI,OAAoC,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,mFAAmF;QACnF,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEhE,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,GAAG,SAAS,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,2FAA2F;QAC3F,KAAK,EAAE,CAAC,QAAiB,EAAE,EAAE;YAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}